Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWpmZjItcWp3OC01NDc2

Command Injection Vulnerability in systeminformation

Impact

command injection vulnerability

Patches

Problem was fixed with a parameter check. Please upgrade to version >= 5.6.4

Workarounds

If you cannot upgrade, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.

Permalink: https://github.com/advisories/GHSA-jff2-qjw8-5476
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWpmZjItcWp3OC01NDc2
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 4 years ago
Updated: almost 2 years ago

CVSS Score: 8.9
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:H

EPSS Percentage: 0.01117
EPSS Percentile: 0.84313

Identifiers: GHSA-jff2-qjw8-5476, CVE-2021-21388
References:

Repository: https://github.com/sebhildebrandt/systeminformation
Blast Radius: 37.4

Affected Packages

npm:systeminformation

Dependent packages: 721
Dependent repositories: 15,997
Downloads: 6,168,568 last month
Affected Version Ranges: < 5.6.4
Fixed in: 5.6.4
All affected versions: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 3.0.0, 3.0.1, 3.1.0, 3.2.0, 3.2.1, 3.3.0, 3.4.0, 3.4.1, 3.4.2, 3.4.3, 3.4.4, 3.5.0, 3.5.1, 3.6.0, 3.7.0, 3.7.1, 3.8.0, 3.8.1, 3.9.0, 3.10.0, 3.10.1, 3.10.2, 3.11.0, 3.11.1, 3.11.2, 3.12.0, 3.12.1, 3.13.0, 3.14.0, 3.15.0, 3.15.1, 3.15.2, 3.16.0, 3.17.0, 3.17.1, 3.17.2, 3.17.3, 3.18.0, 3.19.0, 3.20.0, 3.20.1, 3.21.0, 3.22.0, 3.23.0, 3.23.1, 3.23.2, 3.23.3, 3.23.4, 3.23.5, 3.23.6, 3.23.7, 3.24.0, 3.25.0, 3.25.1, 3.26.0, 3.26.1, 3.26.2, 3.27.0, 3.27.1, 3.28.0, 3.29.0, 3.30.0, 3.30.1, 3.30.2, 3.30.3, 3.30.4, 3.30.5, 3.30.6, 3.31.0, 3.31.1, 3.31.2, 3.31.3, 3.31.4, 3.32.0, 3.32.1, 3.32.2, 3.32.3, 3.32.4, 3.33.0, 3.33.1, 3.33.2, 3.33.3, 3.33.4, 3.33.5, 3.33.6, 3.33.7, 3.33.8, 3.33.9, 3.33.10, 3.33.11, 3.33.12, 3.33.13, 3.33.14, 3.33.18, 3.34.0, 3.34.1, 3.35.0, 3.36.0, 3.37.0, 3.37.1, 3.37.2, 3.37.3, 3.37.4, 3.37.5, 3.37.6, 3.37.7, 3.37.8, 3.37.9, 3.37.10, 3.37.11, 3.37.12, 3.38.0, 3.39.0, 3.40.0, 3.40.1, 3.41.0, 3.41.1, 3.41.2, 3.41.3, 3.41.4, 3.42.0, 3.42.1, 3.42.2, 3.42.3, 3.42.4, 3.42.5, 3.42.6, 3.42.8, 3.42.9, 3.42.10, 3.43.0, 3.44.0, 3.44.1, 3.44.2, 3.45.0, 3.45.1, 3.45.2, 3.45.3, 3.45.4, 3.45.5, 3.45.6, 3.45.7, 3.45.8, 3.45.9, 3.45.10, 3.46.0, 3.47.0, 3.48.0, 3.48.1, 3.48.2, 3.48.3, 3.48.4, 3.49.0, 3.49.1, 3.49.2, 3.49.3, 3.49.4, 3.50.0, 3.50.1, 3.50.2, 3.50.3, 3.51.0, 3.51.1, 3.51.2, 3.51.3, 3.51.4, 3.52.0, 3.52.1, 3.52.2, 3.52.3, 3.52.4, 3.52.5, 3.52.6, 3.52.7, 3.53.0, 3.53.1, 3.54.0, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7, 4.0.8, 4.0.9, 4.0.10, 4.0.11, 4.0.12, 4.0.13, 4.0.14, 4.0.15, 4.0.16, 4.1.0, 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.5, 4.1.6, 4.1.7, 4.1.8, 4.2.0, 4.2.1, 4.3.0, 4.4.0, 4.4.1, 4.5.0, 4.5.1, 4.6.0, 4.6.1, 4.7.0, 4.7.1, 4.7.2, 4.7.3, 4.8.0, 4.8.1, 4.8.2, 4.8.3, 4.8.4, 4.9.0, 4.9.1, 4.9.2, 4.10.0, 4.11.0, 4.11.1, 4.11.2, 4.11.3, 4.11.4, 4.11.5, 4.11.6, 4.12.0, 4.12.1, 4.12.2, 4.13.0, 4.13.1, 4.13.2, 4.14.0, 4.14.1, 4.14.2, 4.14.3, 4.14.4, 4.14.5, 4.14.6, 4.14.7, 4.14.8, 4.14.9, 4.14.10, 4.14.11, 4.14.12, 4.14.13, 4.14.14, 4.14.15, 4.14.16, 4.14.17, 4.15.0, 4.15.1, 4.15.2, 4.15.3, 4.16.0, 4.16.1, 4.17.0, 4.17.1, 4.17.2, 4.17.3, 4.18.0, 4.18.1, 4.18.2, 4.18.3, 4.19.0, 4.19.1, 4.19.2, 4.19.3, 4.19.4, 4.20.0, 4.20.1, 4.21.0, 4.21.1, 4.21.2, 4.21.3, 4.22.0, 4.22.1, 4.22.2, 4.22.3, 4.22.4, 4.22.5, 4.22.6, 4.22.7, 4.23.0, 4.23.1, 4.23.2, 4.23.3, 4.23.4, 4.23.5, 4.23.6, 4.23.7, 4.23.8, 4.23.9, 4.23.10, 4.24.0, 4.24.1, 4.24.2, 4.25.0, 4.25.1, 4.25.2, 4.26.0, 4.26.1, 4.26.2, 4.26.3, 4.26.4, 4.26.5, 4.26.6, 4.26.7, 4.26.8, 4.26.9, 4.26.10, 4.26.11, 4.26.12, 4.27.0, 4.27.1, 4.27.2, 4.27.3, 4.27.4, 4.27.5, 4.27.6, 4.27.7, 4.27.8, 4.27.9, 4.27.10, 4.27.11, 4.28.0, 4.28.1, 4.29.0, 4.29.1, 4.29.2, 4.29.3, 4.30.0, 4.30.1, 4.30.2, 4.30.3, 4.30.4, 4.30.5, 4.30.6, 4.30.7, 4.30.8, 4.30.9, 4.30.10, 4.30.11, 4.31.0, 4.31.1, 4.31.2, 4.32.0, 4.33.0, 4.33.1, 4.33.2, 4.33.3, 4.33.4, 4.33.5, 4.33.6, 4.33.7, 4.33.8, 4.34.0, 4.34.1, 4.34.2, 4.34.3, 4.34.4, 4.34.5, 4.34.6, 4.34.7, 4.34.8, 4.34.9, 4.34.10, 4.34.11, 4.34.12, 4.34.13, 4.34.14, 4.34.15, 4.34.16, 4.34.17, 4.34.18, 4.34.19, 4.34.20, 4.34.21, 4.34.22, 4.34.23, 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.1.0, 5.1.1, 5.1.2, 5.2.0, 5.2.1, 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.2.6, 5.2.7, 5.3.0, 5.3.1, 5.3.2, 5.3.3, 5.3.4, 5.3.5, 5.4.0, 5.5.0, 5.6.0, 5.6.1, 5.6.2, 5.6.3
All unaffected versions: 5.6.4, 5.6.5, 5.6.6, 5.6.7, 5.6.8, 5.6.9, 5.6.10, 5.6.11, 5.6.12, 5.6.13, 5.6.14, 5.6.15, 5.6.16, 5.6.17, 5.6.18, 5.6.19, 5.6.20, 5.6.21, 5.6.22, 5.7.0, 5.7.1, 5.7.2, 5.7.3, 5.7.4, 5.7.5, 5.7.6, 5.7.7, 5.7.8, 5.7.9, 5.7.10, 5.7.11, 5.7.12, 5.7.13, 5.7.14, 5.8.0, 5.8.1, 5.8.2, 5.8.3, 5.8.4, 5.8.5, 5.8.6, 5.8.7, 5.8.8, 5.8.9, 5.9.0, 5.9.1, 5.9.2, 5.9.3, 5.9.4, 5.9.5, 5.9.6, 5.9.7, 5.9.8, 5.9.9, 5.9.10, 5.9.11, 5.9.12, 5.9.13, 5.9.14, 5.9.15, 5.9.16, 5.9.17, 5.9.18, 5.10.0, 5.10.1, 5.10.2, 5.10.3, 5.10.4, 5.10.5, 5.10.6, 5.10.7, 5.11.0, 5.11.1, 5.11.2, 5.11.3, 5.11.4, 5.11.5, 5.11.6, 5.11.7, 5.11.8, 5.11.9, 5.11.10, 5.11.11, 5.11.12, 5.11.13, 5.11.14, 5.11.15, 5.11.16, 5.11.17, 5.11.18, 5.11.19, 5.11.20, 5.11.21, 5.11.22, 5.11.23, 5.11.24, 5.11.25, 5.11.26, 5.12.0, 5.12.1, 5.12.2, 5.12.3, 5.12.4, 5.12.5, 5.12.6, 5.12.7, 5.12.8, 5.12.9, 5.12.10, 5.12.11, 5.12.12, 5.12.13, 5.12.14, 5.12.15, 5.13.0, 5.13.1, 5.13.2, 5.13.3, 5.13.4, 5.13.5, 5.14.0, 5.14.1, 5.14.2, 5.14.3, 5.14.4, 5.15.0, 5.15.1, 5.16.0, 5.16.1, 5.16.2, 5.16.3, 5.16.4, 5.16.5, 5.16.6, 5.16.7, 5.16.8, 5.16.9, 5.17.0, 5.17.1, 5.17.2, 5.17.3, 5.17.4, 5.17.5, 5.17.6, 5.17.7, 5.17.8, 5.17.9, 5.17.10, 5.17.11, 5.17.12, 5.17.13, 5.17.14, 5.17.15, 5.17.16, 5.17.17, 5.18.0, 5.18.1, 5.18.2, 5.18.3, 5.18.4, 5.18.5, 5.18.6, 5.18.7, 5.18.8, 5.18.9, 5.18.10, 5.18.11, 5.18.12, 5.18.13, 5.18.14, 5.18.15, 5.19.0, 5.19.1, 5.20.0, 5.21.0, 5.21.1, 5.21.2, 5.21.3, 5.21.4, 5.21.5, 5.21.6, 5.21.7, 5.21.8, 5.21.9, 5.21.10, 5.21.11, 5.21.12, 5.21.13, 5.21.14, 5.21.15, 5.21.16, 5.21.17, 5.21.18, 5.21.19, 5.21.20, 5.21.21, 5.21.22, 5.21.23, 5.21.24, 5.21.25, 5.22.0, 5.22.1, 5.22.2, 5.22.3, 5.22.4, 5.22.5, 5.22.6, 5.22.7, 5.22.8, 5.22.9, 5.22.10, 5.22.11, 5.23.0, 5.23.1, 5.23.2, 5.23.3, 5.23.4, 5.23.5, 5.23.6, 5.23.8, 5.23.9, 5.23.10, 5.23.11, 5.23.12, 5.23.13, 5.23.14, 5.23.15, 5.23.16, 5.23.17, 5.23.18, 5.23.19, 5.23.20, 5.23.21, 5.23.22, 5.23.23, 5.23.24, 5.23.25, 5.24.0, 5.24.1, 5.24.2, 5.24.3, 5.24.4, 5.24.5, 5.24.6, 5.24.7, 5.24.8, 5.24.9, 5.25.0, 5.25.1, 5.25.2, 5.25.3, 5.25.4, 5.25.5, 5.25.6, 5.25.7, 5.25.8, 5.25.9, 5.25.10, 5.25.11